We can use Fiat-Shamir heuristic to replace 3-move Schnorr's protocol with 1-move non-interactive protocol.
When I implement this non-interactive protocol( ref. https://en.wikipedia.org/wiki/Fiat%E2%80%93Shamir_heuristic): That is
Let $G$ be a cyclic group with order $q$.
Peggy needs to prove that she knows $x$ which is the discrete logarithm of $y =g^x$ to a fixed base $g$.
- She randomly chooses an element $v \in [1,q-1]$ and computes $t = g^v$.
- She computes $c = H(g,y,t)$, where $H$ is a cryptographic hash function (implementing random oracle).
She computes $r = v-cx \pmod q$. The proof is the pair $(t,r)$.
Anyone can check this proof by $t = g^r \cdot y^c$.
My question is that:
Assume that Peggy is prover and Victor is verifier. Can Peggy send $y =g^x$ and a proof $(t,r)$ in the same round?
Or it should be divided it into two rounds:
- The first round is that Peggy sends $y=g^x$ to Victor.
- The second round is that a proof $(t,r)$ to Victor.
Does it arise any risk if we combine two rounds?